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Mobile and portable Monitoring Systems for: 

• GSM active on air monitoring 

• GSM passive on air monitoring 

• GSM locating systems 

• IP Monitoring 

• Satellite interception for INMARSAT & 

Thuraya 

Valuable & powerful add on application to a 
central Monitoring Center (e.g Siemens, Atis, 
etc.) 
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GSM Monitoring "on air" 




GSM Infrastructure 



MSC 



6 * i 



jHlIltl, 

mwn 



• Mobile sees other cells 

GSM-on air Monitoring system 
clones network cell 



• Force mobile to lock-on 



Situation at the Radio Link 

* Telephone number is never transmitted 

* I MSI and IMEI only available during log on 

* Temporary I MSI for subscriber anonymity (TIMSI) 

* No access to network providers internal databases 

* Ciphering 

* Frequency hopping 

Once identity known other interception systems 
can be used for long-term monitoring 
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Active GSM Monitoring "on air" 





Log on to active on air monitoring system, (900 & 1800 MHz) 

The vituell Basestation is for the target phone more attarctive than the 
"real" Basestation 
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Active GSM Monitoring "on air" 

Scan Mode 

• Subscribers in VESTS area log on and their I MS I and IMEI are stored 

• Al! phones which are of non interest are sent back to the original network 
after data evaluation 



Search Mode 

* Search for dedicated I MSI and / or IMEI among all subscribers 
logged on VBTS 

• Dedicated subscriber remain logged on, all other subscribers are 
sent back to the original network 





IMSI: 



IMSI: 262.01 1 11.. IMEI 449193.01 999. 
IMSI: 262.01.222... IMEI 449193.01 .383. 
IMSI: 262.01.333... IMEI 449193.01 .777. 




IMSI: 262.01.11 1... IMEI 449193.01 999... 
IMSI: 262.01.222... IMEI 449193.01 888. . 
IMSI. 430.01 888... IMEI 4901 53.01 ITT... 
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Active GSM Monitoring "on air 



Jam Mode / Deny Mode 



• All subscribers logged on VBTS stay locked 

• Own subscribers can be excluded via job list 

• Jam selected phones by sending 'special software code' 

• Drain the battery of the target phone 




\ 




1 MS 1: 


262.01 111. 


. IMEI 449193.01.999. 


1 MS 1: 


262.01.222.. 


. IMEI 449193.01.888.. 


1 MS 1: 


262 01.333 . 


. IMEI 449193.01.777.. 




Tel .#67890 .receives 
the cell end forwerds it 
to the VBTS 



kidnapper 



VBTS calies target 
using I MSI. 



Dials Tel # 
87890... of 
Teatmobile 



MSC 



Call Monitoring via call forwarding 



eg. negotiator 
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Active GSM Monitoring "on air 



Additional Options: 

* Log on to GPRS Mobiles 

* Faked calls & SMS 

* Database evaluation (alarm list, search list, frequency list, 
etc.), assigning data to target 

* GPS, store GPS data to Database 

* Installation of system into car or as mobile station (case) 

* Remote control via WLAN with Laptop or PDA 

* Direction Finder portable/mobile or installed in a car 



Car Integration 

• Signaling unit 

• Rx/Tx unit 

• Power supply 

• Cell monitor 

• GSM antennas 

• Notebook 

• Integration kit 
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Active GSM Monitoring "on air 



Integration Example 




Exact locating of targets via triangulation and silent call 
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Active GSM Monitoring "on air 




Handheld DF system giving audio and visual target indication 
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Active GSM Monitoring "on air 
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Active GSM Monitoring "on air 



• Remote control capability for the portable 
GSM on air monitoring system 

• Wireless link enables highly covert operation 




Portable Solutions, 
Remote control with PDA 




Integrated solution 




• Communications network via middleware 

■ GSM. interception team now communicates with vehicle DF + handheld DF teams 

* Aim again is to find target mobile 

- now geography requires foot mobile DF teams - perhaps target is in a budding ! 
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Active GSM Monitoring "on air 



Scaled strategic Solution 





Operation 1 



Operation 2 



Command 

Centre 



• Multiple systems P vehicle DF + handheld DF teams 

• Controlled from a command centre (either static or mobile} 

■ Large area coverage 

• Fully integrated solution for simultaneously locating multiple targets 
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Active GSM Monitoring "on air 



Conclusion 



Advantages 

• Useful add on system to a central Monitoring Center for 

- getting information out of the GSM network (IMEI, I MSI, etc.) 

- exact location of targets in combination with a MC-GIS 

- MC provides information to the mobile on air GSM monitoring system for 
outside operations 

• Blocking of subscribers 

• Exact location of subscribers by using DF or homing 

• Silent call. Faked calls and SMS 

• Portable use e.g. in hotels/airports/etc., camouflaged operation 

• Reasonable inverstment 

• Operation independent and without involvement of the GSM operators 



Conclusion 

Disadvantages 

• Limited functionality of call monitoring, only outgoing calls can be monitored 

• System operation must be very carefully in order that the target and the 
operator will not recognize the observation 

• Operation must be close to the target and depends heavily on the 
environmental conditions (strength of GSM network, buildings, etc.) 

• Operational personal must have good knowledge in GSM technology and 
frequency theory 

• Only GSM Monitoring possible (no CDMA, UMTS) 
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Passive GSM Monitoring "on air" 




Situation at the Radio Link 



• Telephone number is never transmitted 

• I MSI and IMEI only available during log on 

• Mostly Temporary IMSI (TIMSI) on the airinterface 

• Tel. No.. IMSI and IMEI only when switching on the handset 

• No access to network providers internal databases 

• Ciphering (5.0, 5.1 or 5.2, 5.3 under development) 

• Frequency hopping 




All this will have an impact of the interception results in case of 
passive monitoring of the air interface!! I 
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Passive GSM Monitoring "on air" 



Pro's Passive GSM air interface monitoring systems 

• Monitoring of incoming and outgoing calls 

• Detection of phone calls based on TIMSI, decoding and 
recording 

• Display and recording of protocols, network data of the radio 
cell and SMS 

• Mobile operation, remote control of the system possible 

• System is built up modular, basic system can monitor up to 8 
channels (= 4 conversations) 

• Hi distange range when using directional antenns ( several 
Kms) 



Disadvantages Passive GSM air interface monitoring systems 

• Only in case of 5.0. or 5.2 encryption is used on the air interface, 
monitoring of calls is possible 

• No control of the target subscriber is possible, e.g. blocking of phones 

• Operation is difficult as only TIMSI is seen of many phones 
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Portable IP Monitoring Systems 



How to connect oassivlv into Ethernet 



Router Swftcli 
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Portable IP Monitoring Systems 



Interfaces and 
functions 



Description 




2U Chassis 




Max storage Capacity 




900 GB 




RAID- Controller 




yes 




Fast Ethernet monitoring 




yes 




Gigabit Ethernet monitoring 




yes 




T1/E1 monitoring 




yes 




T3/E3 monitoring 




yes 




V.35/X.21 monitoring 




yes 




FDD1/HSSI monitoring 




yes 




OC-3 monitoring {Optical Carrier 
155 Mbit/s, ATM or POS networks) 




yes 




OC-12 monitoring (Optical Carrier 
G22 Mbit/s, ATM or POS networks) 




yes 




Multi-Interface monitoring 




yes 




VoIP monitoring 




yes 





Reconstruction 
Of IP Data 



> Complete Analysis on all protocol layers 

. pp P 



• UDP 

• ICMP 

•TCP 

-FTP 

-SMTP 

-POP3 

-TELNET 

- Chat 
-VoIP 

- http 

> E-Mail reconstruction inch all attachments 

> VoIP reconstruction 
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Portable IP Monitoring Systems 



Reconstruction of E-Mail 
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Reconstruction of HTTP 
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Reconstruction of VoIP 




Button for replaying th* VoIP call contents 
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Reconstruction of CAHT sessions as HTML format 
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Portable IP Monitoring Systems 



Pro's portable IP monitoring systems 

• Quick deployment possible in case of 
urgent operation is required 

• Monitoring of IP within private IP 
networks (e.g. big companies, hotels, 
university} 

• Reasonable investment for e.g. 
monitoring of small ISPs 

• Mobile use of the system outside 
the country 

• Modular system 
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INMARSAT Satellite Monitoring Systems 




MOBILE EARTH STATION 
(MES) 



6.4GHz 

UP 



INMARSAT MONITORING SYSTEM 
(IMS) 



Subscriber orientated Monitoring of INMARSAT communications worldwide: 

• Voice 

• Fax 

• data 




Monitoring of all communications links of one satellite 
Call Monitoring of specific targets 
Detection of targets within a certain area 
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THURAYA Satellite Monitoring Systems 





Coverage 



Earth Station in Sharjah / UAE 



Spot Beam configuration 



Handheld, Dual band 
GSM and Thuraya 



Principles of strategic Thuraya Monitoring 





1.6GHZ 

UP 



MOBILE EARTH STATION 
(WES] 



6.6GHz 

UP 



PRIMARY SATE WAY 
(PQUW 






THURAYA MONITORING SYSTEM 
(TMS] 
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THURAYA Satellite Monitoring Systems 



Monitoring of: 

• Location of the Mobile 

• Time of activity 

• Type of activity (call, answer to a call, location update) 

• Service provider of the mobile 

• Called Number in case of mobile originated call 




Monitoring of call content not possible due to encryption 
which is used between handheld and Satelite 




Example for SAT- dish for monitoring the 

up and down link between Satelite and gateway (approx. lOmtr) 



Display of the 
location of the 
subscriber 
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Mobile and portable Monitoring Systems for: 

• GSM active on air monitoring 

• GSM passive on air monitoring 

• GSM locating systems 

• IP Monitoring 

• Satellite interception for INMARSAT & Thuraya 

Valuable & powerful add on application to a central 
Monitoring Center (e.g. Siemens, Atis, etc.) 
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